StreamRat Android Banking Trojan Uses Social Media Ads to Take Control of Devices
Summary
ThreatFabric details StreamRat, an Android banking trojan promoted through ads targeting Spanish-speaking users. Its dropper installs the malware, which abuses Accessibility Services and screen capture for remote control, credential theft, and data collection.
Key points
- The campaign used Meta and TikTok ads impersonating a free TV-streaming service; one Meta campaign reached about 570,000 users.
- Victims were directed to a phishing site and a two-stage APK installation. The dropper temporarily routes device traffic through a non-functional VPN.
- StreamRat abuses Accessibility Services and MediaProjection for remote control, screen capture, UI-tree collection, and keylogging.
- The malware supports credential-stealing overlays, screen-blocking overlays, and collection of installed-app lists and device information.
- StreamRat communicates with its hardcoded C2 over WebSockets and uses checksums to avoid transmitting duplicate screen frames and UI data.
- The control panel and role-based access appear consistent with a Malware-as-a-Service offering; researchers link the actor to prior distribution of GodFather and Mirax.
Article Details
- Attack Vectors
- Spanish-speaking users were lured through Meta and TikTok advertisements impersonating a free TV-streaming service and directed to a phishing website.
- The website identified Android devices, guided victims to enable installation from unknown sources and Accessibility Services, and delivered a dropper APK.
- The dropper established a deliberately non-functional VPN connection to disrupt other applications’ internet access, then downloaded and installed the StreamRat payload.
- StreamRat abused Accessibility Services and MediaProjection for remote control, screen capture, UI-tree collection, and credential-stealing overlays.
- Defensive Notes
- Treat an application requesting both package-installation capabilities and VPN functionality as a notable risk signal requiring closer scrutiny.
- The article assesses that the dropper’s non-functional VPN may reduce the effectiveness of cloud-based reputation and code-analysis checks; it does not fully disable Google Play Protect, which also performs offline detection.
- The campaign primarily targeted users in Spain, and the article reports that most observed victims were located there.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]32[.]2[.]245 | Server associated with the StreamRat infrastructure, listed as a C2 indicator. |
| IPV4 | 45[.]147[.]28[.]59 | Server associated with the StreamRat infrastructure, listed as a C2 indicator. |
| SHA256 | ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 | SHA-256 hash of a StreamRat-associated application listed in the indicators of compromise. |
| SHA256 | e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c | SHA-256 hash of a StreamRat-associated application listed in the indicators of compromise. |
MITRE ATT&CK
T1412StreamRat captures device-screen content through MediaProjection or Accessibility screenshots and sends frames to its C2 server.T1417.001StreamRat captures data entered by victims and uses overlays to collect information submitted through them.T1422StreamRat retrieves and sends a list of applications installed on the infected device.T1437.001The dropper and payload use network connections to retrieve the payload and communicate with the C2 server.T1444StreamRat uses Accessibility Services to interact with the device, control it remotely, and enable overlay-based deception.
Malware
GodFatherThe threat actor has used at least three different financial malware families, including GodFather, Mirax, and StreamRat.MiraxIf a victim proceeded with the file download, the payload was retrieved from a GitHub repository belonging to the same user who had previously distributed the Mirax trojan.StreamRatThreatFabric researchers have uncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaign
Vendors
Products
AndroidThreatFabric researchers have uncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaignFacebookWe cannot determine which specific Meta platform was the main focus of the campaign; however, the same advertising banners were likely displayed on both Facebook and Instagram.Google Play ProtectGoogle Play Protect is a particularly plausible target, as it is enabled by default on Play Protect-certified Android devices and performs additional analysis of applications installed from unknown sources.InstagramWe cannot determine which specific Meta platform was the main focus of the campaign; however, the same advertising banners were likely displayed on both Facebook and Instagram.TikTokuncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaign reaching approximately